{"id":1913,"date":"2026-09-23T12:22:23","date_gmt":"2026-09-23T06:52:23","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1913"},"modified":"2026-09-24T11:29:33","modified_gmt":"2026-09-24T05:59:33","slug":"check-point-cve-2026-93616-management-server-zero-day","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/check-point-cve-2026-93616-management-server-zero-day\/","title":{"rendered":"Check Point CVE-2026-93616: Management Server Zero-Day Exploited in Targeted Attacks"},"content":{"rendered":"

Check Point has patched CVE-2026-93616, a critical Security Management vulnerability exploited before its public disclosure. The flaw targets a sensitive part of enterprise network infrastructure: systems used to manage security policies and related operations.<\/p>\n

Check Point observed a handful of pinpointed attacks on July 23, 2026. The company disclosed the vulnerability and released fixes on September 22.<\/p>\n

CVE-2026-93616 combines directory traversal and file-upload weaknesses in the Check Point Management web service. An unauthenticated attacker can upload and execute arbitrary scripts. Check Point also states that the flaw can load an arbitrary Java class. The vulnerability carries a CVSS v3.1 score of 9.8.<\/p>\n

Check Point CVE-2026-93616 at a Glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE<\/span><\/b>\u00a0<\/span><\/td>\nCVE-2026-93616<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerability type<\/span><\/b>\u00a0<\/span><\/td>\nDirectory\/path traversal and file upload<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVSS<\/span><\/b>\u00a0<\/span><\/td>\n9.8, CVSS v3.1<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Authentication required<\/span><\/b>\u00a0<\/span><\/td>\nNo<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Potential impact<\/span><\/b>\u00a0<\/span><\/td>\nArbitrary script execution and arbitrary Java class loading<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Observed exploitation<\/span><\/b>\u00a0<\/span><\/td>\nYes, limited targeted attacks<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Observed attack date<\/span><\/b>\u00a0<\/span><\/td>\nJuly 23, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Fix released<\/span><\/b>\u00a0<\/span><\/td>\nSeptember 22, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Check Point identifies R82.20, R82.10 Jumbo Hotfix Take 44 or lower, R82 Jumbo Hotfix Take 126 or lower, R81.20 Jumbo Hotfix Take 166 or lower, and R81.10 Jumbo Hotfix Take 190 or lower as affected. The affected end-of-support releases also include R80, R80.10, R80.20, R80.30, R80.40, and R81.<\/p>\n

How Check Point CVE-2026-93616 Enables Script Execution<\/h2>\n

The distinctive risk in Check Point CVE-2026-93616 comes from crossing the management server’s file-path boundary before authentication.<\/p>\n

Check Point describes the issue as a pre-authentication path traversal vulnerability in its Management web service. The weakness allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class. The CVE description further identifies directory traversal combined with file upload as the underlying issue.<\/p>\n

Therefore, an attacker does not first need an authenticated administrator session to exploit the vulnerable functionality.<\/p>\n

However, the available Check Point advisory does not publicly document the complete request sequence used in the July attacks. It also does not identify the attackers or targeted organizations. Check Point has not detailed what the attackers did after exploitation in those incidents.<\/p>\n

That distinction matters. The vulnerability can enable arbitrary script execution. However, publicly available reporting does not establish every post-exploitation action performed during the observed attacks.<\/p>\n

Which Check Point Management Systems Need Attention?<\/h2>\n

Check Point’s guidance identifies several affected products. These include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.<\/p>\n

Quantum Force and Quantum Spark firewall-only appliances are not affected by CVE-2026-93616. However, standalone deployments where management and firewall functions run on the same device are affected and should be remediated. Smart-1 Cloud has already been patched.<\/p>\n

This Check Point Security Management Server vulnerability affects several management and logging products across supported and legacy releases.<\/p>\n

Check Point recommends upgrading supported releases to the appropriate fixed build<\/a>:<\/p>\n